CVE-2019-20627

CRITICAL

AutoUpdater.NET < 1.5.8 - XML External Entity Injection in AutoUpdater.cs

Title source: llm

AutoUpdater.cs in AutoUpdater.NET before 1.5.8 allows XXE.

Core 3

Core References

Patch, Third Party Advisory x_refsource_misc

Third Party Advisory x_refsource_misc

Exploit, Third Party Advisory x_refsource_misc

CVSS v3 9.8

EPSS 0.0044

EPSS Percentile 63.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-611

Status published

Products (2)

nuget/Autoupdater.NET.Official 0 - 1.5.8NuGet

rbsoft/autoupdater.net < 1.5.8

Published Mar 23, 2020

Tracked Since Feb 18, 2026